CVE-2024-8691 Overview
CVE-2024-8691 is an authorization flaw [CWE-863] in the GlobalProtect portal of Palo Alto Networks PAN-OS software. An authenticated GlobalProtect user can impersonate another GlobalProtect user through the portal. Exploitation disconnects the impersonated user from their active session. PAN-OS logs record the impersonated user as the authenticated party, obscuring the attacker's true identity.
The vulnerability affects PAN-OS deployments that expose the GlobalProtect portal to authenticated users. The issue does not require user interaction beyond attacker authentication to the portal.
Critical Impact
Attackers with valid GlobalProtect credentials can hijack other users' identities in PAN-OS logs, disrupt legitimate remote-access sessions, and complicate incident attribution.
Affected Products
- Palo Alto Networks PAN-OS (GlobalProtect portal component)
- Firewall appliances running vulnerable PAN-OS releases
- Cloud and virtualized PAN-OS deployments exposing GlobalProtect
Discovery Timeline
- 2024-09-11 - CVE-2024-8691 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-8691
Vulnerability Analysis
The flaw resides in how the GlobalProtect portal validates the identity claim of an authenticated session. An authenticated user submits a request that identifies a target GlobalProtect user, and the portal accepts the supplied identity without enforcing that the requester owns it. The authorization layer trusts a user-controlled identifier instead of binding actions to the requester's authenticated principal.
When exploited, the portal treats the attacker's actions as if the impersonated user performed them. The genuine user is forcibly disconnected from GlobalProtect. Audit logs attribute the session to the impersonated account, breaking the chain of accountability that defenders rely on during investigations.
Because the attacker must already authenticate to GlobalProtect, exploitation typically follows credential theft, phishing, or insider misuse. The impact is limited in confidentiality and integrity but meaningful for forensic reliability and remote-access availability.
Root Cause
The root cause is improper authorization [CWE-863]. The GlobalProtect portal fails to enforce that operations acting on a user identity are restricted to that user's authenticated session. Identity is derived from request input rather than the session principal.
Attack Vector
The attack vector is network-based against the GlobalProtect portal. An attacker holding valid GlobalProtect credentials issues a crafted request that names another GlobalProtect user. The portal processes the request under the impersonated identity, terminating the victim's active session and writing log entries under the victim's name. No additional privilege escalation or user interaction is required beyond the initial authenticated session.
See the Palo Alto Networks CVE-2024-8691 Advisory for vendor technical details.
Detection Methods for CVE-2024-8691
Indicators of Compromise
- Unexpected GlobalProtect disconnect events for active users during business hours.
- Successive authentication log entries for the same GlobalProtect user from different source IP addresses within short intervals.
- Portal activity attributed to users who report they were not connected at the logged time.
- Session establishments that do not correlate with endpoint telemetry from the impersonated user's device.
Detection Strategies
- Correlate GlobalProtect portal authentication logs with endpoint telemetry to confirm the logged user actually initiated the session.
- Alert on user disconnect events immediately followed by a new session for the same identity from a different source IP or geolocation.
- Compare GlobalProtect source IP history per user and flag deviations from baseline network origins.
Monitoring Recommendations
- Forward PAN-OS GlobalProtect logs to a centralized SIEM or data lake for cross-source correlation.
- Baseline normal session duration, source IP, and device posture per GlobalProtect user and alert on outliers.
- Monitor for repeated forced-disconnect patterns that could indicate systematic impersonation attempts.
How to Mitigate CVE-2024-8691
Immediate Actions Required
- Apply the fixed PAN-OS release identified in the Palo Alto Networks CVE-2024-8691 Advisory.
- Enforce multi-factor authentication on all GlobalProtect portal accounts to raise the bar for the initial authenticated foothold.
- Rotate credentials for any GlobalProtect user showing anomalous session or disconnect activity.
- Restrict GlobalProtect portal exposure to required source networks where operationally feasible.
Patch Information
Palo Alto Networks has published fixed PAN-OS versions in its official advisory. Administrators should consult the Palo Alto Networks CVE-2024-8691 Advisory for the exact fixed release trains that apply to their deployed PAN-OS branch and upgrade accordingly.
Workarounds
- Limit GlobalProtect portal access to trusted source IP ranges using firewall policy where remote access allows it.
- Enforce certificate-based or hardware-token authentication in addition to passwords to reduce credential-theft risk.
- Increase log retention and forwarding for GlobalProtect events to support post-incident attribution while a patch is scheduled.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
